SUPPLEMENTARY INFORMATION:

On March 25, 2025, the President signed Executive Order (E.O.) 14249, Protecting America's Bank Account Against Fraud, Waste, and Abuse, which requires Executive Branch agencies to “review and modify, as applicable, their relevant system of records notices under the Privacy Act of 1974 to include a `routine use' that allows for the disclosure of records to the Department of the Treasury for the purposes of identifying, preventing, or recouping fraud and improper payments, to the extent permissible by law.” On August 20, 2025, OMB issued Memorandum M-25-32, Preventing Improper Payments and Protecting Privacy Through Do Not Pay, which provides guidance to agencies for implementing the new routine use requirement under E.O. 14249. The memorandum requires agencies to identify systems of records that maintain information “whose disclosure to Treasury would be relevant and necessary for identifying, preventing, or recouping improper payments by reviewing payment and award eligibility through the Do Not Pay Working System” and add a new routine use to each identified system to allow such disclosure. See OMB M-25-32, Appendix 1. Accordingly, this notice hereby modifies SBA 21 system of records to replace routine use p. with the following routine use prescribed by OMB:

“AA. To the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian ( printed page 56704) tribe) in a state-administered, federally funded program.”

SBA has also modified SBA 21 system of records to replace routine use (g). with the following routine use:

“g. To the public on approved loans in order to inform the public on how taxpayer dollars have been utilized when there is a legitimate public interest in the disclosure of the information and the disclosure would not constitute an unwarranted invasion of personal privacy. This information includes recipient name and address, term and rate of the loan and the amount paid in full or charged off.”

SBA has added a “Purpose(s) of the System”, “Security Classification”, and “History” to comply with A-108.

SBA has made technical corrections to the following sections: “System Location”, “System Manager”, “Authority for Maintenance of the System”, “Categories of Individuals Covered By the System”, “Categories of Records in the System”, “Routine Uses of Records Maintained in the System”, “Policies and Practices for Storage of Records”, “Policies and Practices for Retrieval of Records”, “Policies and Practices for Retention and Disposal of Records”, and “Administrative, Technical and Physical Safeguards”, “Record Access Procedures”, “Contesting Record Procedures”, “Notification Procedures”.

SYSTEM NAME AND NUMBER:

Loan System (SBA21).

SECURITY CLASSIFICATION:

Unclassified.

SYSTEM LOCATION:

Headquarters. U.S. Small Business Administration, 409 3rd Street SW, Washington, DC 20416.

SYSTEM MANAGER(S):

Associate Administrator for Capital Access; Director, Office of Financial Programs. U.S. Small Business Administration, 409 3rd Street SW, Washington, DC, 20416, 800-827-5722.

AUTHORITY FOR MAINTENANCE OF THE SYSTEM:

15 U.S.C. 631 et seq. (Small Business Act, all provisions relating to loan programs); Coronavirus Aid, Relief, and Economic Security Act, 15 U.S.C. 15 U.S.C. 636(a)(36); American Rescue Plan, Pub. L. 117-12, March 11, 2021, 135 Stat. 4.

PURPOSE(S) OF THE SYSTEM:

To collect financial information used to determine applicants' eligibility and borrower and individual guarantor eligibility for business loans (non-disaster) that are made by third-party lenders and guaranteed by SBA, Restaurant Revitalization Fund awards, Microloan grants, and surety bonds. Additionally, the system is used to collect information to direct small businesses potentially interested in onshoring to the SBA's lending programs, including Lender Match.

CATEGORIES OF INDIVIDUALS COVERED BY THE SYSTEM:

Individuals ( i.e., borrowers, guarantors, principals of businesses named in loan records, awardees, loan agents), throughout the life of SBA's interest in the loan or award. For purposes of this Systems of Records Notice, “loan agents” means all “Agents” as defined in 13 CFR 103.1(a) that are involved in the business loan process ( e.g., loan packagers, brokers, and referral agents).

CATEGORIES OF RECORDS IN THE SYSTEM:

Personal and commercial information including credit history, financial information, identifying number or other personal identifier such as name, Social Security number, date of birth, address, telephone number, SBA identifier, loan number, Participating Lender identifier, Participating Lender name, loan information, fees paid to third party agents as set forth in SBA Form 159, compliance and enforcement information on individuals named in business loan and/or awardee files, including but not limited to Loan Agents, throughout the entirety of SBA's interest in the loan.

RECORD SOURCE CATEGORIES:

Subject individuals and businesses, financial institutions, credit reporting agencies, law enforcement agencies and SBA resource partners, including lender or other Federal agencies with whom SBA has a data sharing or similar agreement.

ROUTINE USES OF RECORDS MAINTAINED IN THE SYSTEM, INCLUDING CATEGORIES OF USERS AND PURPOSES OF SUCH USES:

In addition to those disclosures generally permitted under 5 U.S.C.552a(b) of the Privacy Act, all or a portion of the information contained in this system may be disclosed to authorized entities, as is determined to be relevant and necessary, outside SBA as a routine use pursuant to 5 U.S.C. 552a(b)(3) as follows:

• AA. To the U.S. Department of the Treasury when disclosure of the information is relevant to review payment and award eligibility through the Do Not Pay Working System for the purposes of identifying, preventing, or recouping improper payments to an applicant for, or recipient of, Federal funds, including funds disbursed by a state (meaning a state of the United States, the District of Columbia, a territory or possession of the United States, or a federally recognized Indian tribe) in a state-administered, federally funded program.
• a. To SBA Resource Partner, its successors or assigns, (i.e., participating lender, certified development company, micro lender) who initially collected the individual's information for the purpose of making and servicing loans.
• b. To a Congressional office from an individual's record, when that office is inquiring on the individual's behalf and at the request of the individual.
• c. To SBA contractors, grantees, experts, volunteers and interns who have been engaged by SBA to assist in the performance of a service related to this system of records and who need access to the records in order to perform this activity.
• d. To a federal, state, local, territorial, tribal, or foreign law or regulatory enforcement authority or other appropriate entity charged with the responsibility for investigating or prosecuting such violation or charged with enforcing or implementing a law where a record, either alone or in conjunction with other information, indicates a violation or potential violation of such law, whether criminal, civil, or regulatory in nature.
• e. To qualified investors who have signed a confidentiality agreement related to review of files for the purpose of evaluating, negotiating and implementing the purchase of loans from SBA as a part of SBA's Asset Sales program.
• f. To request information from a Federal, State, local government agency or a private credit agency maintaining civil, criminal or other information relevant to determining an applicant's suitability for a business loan. This applies to individuals involved in business loans.
• g. To the public on approved loans in order to inform the public on how taxpayer dollars have been utilized when there is a legitimate public interest in the disclosure of the information and the disclosure would not constitute an unwarranted invasion of personal privacy. This information includes recipient name and address, term and rate of the loan and the amount paid in full or charged off.
• h. To 7(a) and 504 lenders and/or participating contractors for purposes of the Loan and Lender Monitoring System.
• i. To the Department of Justice (DOJ) wh any of the following is a party to litigation or has an interest in such ( printed page 56705) litigation, and the use of such records by DOJ is deemed by SBA to be relevant and necessary to the litigation, provided, however, that in each case, SBA determines the disclosure of the records to DOJ is a use of the information contained in the records that is compatible with the purpose for which the records were collected: SBA, or any component thereof; any SBA employee in his or her official capacity; any SBA employee in his or her individual capacity where DOJ has agreed to represent the employee; or The United States Government, where SBA determines that litigation is likely to affect SBA or any of its components.
• j. In a proceeding before a court, or adjudicative body, or a dispute resolution body before which SBA is authorized to appear or when any of the following is a party to litigation or has an interest in such litigation, provided, however, that SBA determines that the use of such records is relevant and necessary to the litigation, and that, in each case, SBA determines that disclosure of the records to a court, adjudicative body or a dispute resolution body is a use of the information contained in the records that is a compatible purpose for which the records were collected: SBA, or any SBA component; any SBA employee in his or her official capacity; any SBA employee in his or her individual capacity where DOJ has agreed to represent the employee; or The United States Government, where SBA determines that litigation is likely to affect SBA or any of its components.
• k. To appropriate agencies, entities, and persons when: SBA suspects or has confirmed that the security or confidentiality of information in the system records has been compromised; SBA has determined that as a result of the suspected or confirmed compromise there is a risk of harm to economic or property interests, identity theft or fraud, or harm to the security and integrity of this system or other systems or programs (whether maintained by the Agency or entity) that rely upon the compromised information; and the disclosure made to such agencies, entities and persons is reasonably necessary to assist in connection with SBA's efforts to respond to the suspected or confirmed compromise and prevent, minimize, or remedy such harm.
• l. To state or Federal regulators or legal authorities for the review of Loan Agent fees and activities and for the review of loans generated by Loan Agents (e.g., for performance and other trends).
• m. To GSA and the public for publication of Loan Agent suspensions, revocations and exclusions under13 CFR part 103 in the Excluded Parties List System (or successor system).
• n. To state or Federal regulators for compliance purposes, including the use of loan level data in regulatory safety and soundness reviews and related risk management functions pertaining to SBA-guaranteed loans.
• o. To the Department of Housing and Urban Development or other Federal agency that participates in the Credit Alert Verification Reporting System (CAIVRS) for publication by CAIVRS participants of delinquent debt information of persons (including the names of businesses and individuals) delinquent in paying a debt owed to or guaranteed by the SBA (which includes persons who have caused a prior loss under13 CFR 120.110(q)) on a system to allow searches by participating Government agencies and approved private lenders, consistent with applicable law.

POLICIES AND PRACTICES FOR STORAGE OF RECORDS:

Electronic records are in a secured server, and paper records are in locked files.

POLICIES AND PRACTICES FOR RETRIEVAL OF RECORDS:

Electronic records are retrieved by individual name, personal identifier such as Social Security numbers, loan number, SBA Identifier, Participating Lender identifier, Participating Lender Name, business name, and business identifier. Paper records are retrieved by individual name and SBA Identifier.

POLICIES AND PRACTICES FOR RETENTION AND DISPOSAL OF RECORDS:

In accordance with SBA Standard Operating Procedure 00 41 2, Item Nos. 50:04, 50:08, 50:09, 50:10, 50:11, 50:12, 50:13, 50:19, 50:22, 55:02. Records are retained for the life of SBA's interest in the business loan and/or award and are disposed of according to the reference in the SOP that pertains to a particular type of record and in accordance with record retention schedules set by the National Archives and Records Administration (NARA).

ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS:

Electronic Records: Access and use of electronic records are limited to individuals authorized by SBA who are acting in their official capacities on a need-to-know basis. Those authorized individuals are granted access to electronic records by SBA through the issuance of User ID and/or passcode, which may be used to amend or review the records. Paper Records: Access and use of paper records are limited to individuals authorized by the Agency who are acting in their official capacities on a need-to-know basis. Those authorized individuals are granted access to paper records by SBA through the issuance of keys to locked physical files and/or transmission of copies of the files through secure electronic means using an SBA-issued User ID and/or passcode.

RECORD ACCESS PROCEDURES:

Individuals wishing to request access to records about them should submit a Privacy Act request to the SBA Chief, Freedom of Information and Privacy Act Office, U.S. Small Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or FOIA@sba.gov. Individuals must provide their full name, mailing address, personal email address, telephone number, and a detailed description of the records requested. Individuals requesting access must also follow SBA's Privacy Act regulations regarding verification of identity and access to records (13 CFR part 102 subpart B).

CONTESTING RECORD PROCEDURES:

Individuals wishing to contest information contained in records about them should submit a Privacy Act request to the SBA Chief, Freedom of Information and Privacy Act Office, U.S. Small Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or FOIA@sba.gov. Individuals must provide their full name, mailing address, personal email address, telephone number, and a detailed description of the records requested. Requesting individuals must follow SBA's Privacy Act regulations regarding verification of identity and access to records (13 CFR part 102 subpart B).

NOTIFICATION PROCEDURES:

Individuals may make record inquiries in person at the address listed below or in writing to the Systems Manager through the SBA Chief, Freedom of Information and Privacy Act Office, U.S. Small Business Administration, 409 Third St. SW, Eighth Floor, Washington, DC 20416 or FOIA@sba.gov.

EXEMPTIONS PROMULGATED FOR THE SYSTEM:

None.

HISTORY:

Modification published at 86 FR 23026 (April 30, 2021);

Modification published at 77 FR 61467 (October 9, 2012); ( printed page 56706)

Modification published at 77 FR 15835 (March 16, 2012); 74 FR 14890 (April 01, 2009).

91 FR 56703